Category: Turkiye

In September 2018, the Capital Markets Board (“CMB”) had issued an announcement on its website, declaring that a secondary legislation for crowdfunding was underway. Just recently, on January 4, 2019, CMB published the Draft Communiqué on Equity Crowdfunding No. III-35/A (“Draft Communiqué”). In the announcement, CMB states that the Draft Communiqué aims to ensure the effective penetration of the crowdfunding model into the capital markets legislation and create a regulatory framework for crowdfunding activities.

The Draft Communique addresses principles on (i) crowdfunding platforms, (ii) activities of crowdfunding platforms, (iii) subscription to crowdfunding platforms and the campaign process and (iv) areas for the use of the funds and venture capital firms. The Draft Communique requires crowdfunding platforms to apply to CMB for listing and comply with the specific requirements set forth by CMB. 

The Draft Communique is open to public comments until February 4, 2019. 

(First published by Mondaq on January 8,  2019)

By Gonenc Gurkaynak, Partner, Ceren Yıldız, Counsel ELIG Gürkaynak Attorneys-at-Law

“Just cause” is a term that is used frequently under the Turkish Commercial Code No. 6102 (“TCC”). In broad terms, “just cause” may be defined as a situation in which the relationship between a shareholder and the company and/or between a shareholder and other shareholders becomes unbearable or untenable for valid legal reasons. Although the term “just cause” is frequently employed under the TCC, Turkish lawmakers did not opt to provide an explicit definition of this term under the TCC and instead delegated this duty to the doctrine and the courts.

In this article, we will focus on the use of the term “just cause” in the context of the termination of limited liability companies, exit right and squeeze-out of shareholders in limited liability companies, and we will assess and evaluate the purpose and meaning of the term in light of the recent Court of Appeals decisions.

I. Termination by Just Cause

Article 636 of the TCC lists the circumstances in which a limited liability company shall be terminated. In addition to the customary reasons for termination, such as termination pursuant to the articles of association, initiation of the bankruptcy process following a bankruptcy decision, termination through a resolution of the general assembly of shareholders, or termination as foreseen by other laws, the provision also allows each shareholder to file a lawsuit against the company to request the termination of the limited liability company, if there is “just cause” to terminate the company. Upon request, the court may terminate the company or rule for the “squeeze-out” of the plaintiff shareholder, or for another resolution that is acceptable and suitable for the case at hand.

The reasoning of Article 636 of the TCC refers to Article 531 of the TCC, in which the termination of joint-stock companies by “just cause” is regulated. The reasoning of Article 531 also confirms that the TCC does not explicitly define what constitutes “just cause,” and that its definition is left to be decided by the relevant doctrine and the courts. The reasoning of Article 531 lists certain examples of “just cause” that have been accepted and recognized under Swiss legal doctrine. For example, unlawful invitation of the shareholders to the general assembly meetings, continual violations of the minority shareholders’ rights or the personal rights of the shareholders, obstruction or hindrance of the right to demand information and examination, continuous losses incurred by the company, and constant declines in profits are listed among the examples of “just cause” that are recognized under Swiss doctrine.

Since there is no clear-cut definition or elucidation on the scope and content of the term “just cause” in Turkish law, courts have been required to evaluate each matter on a case-by-case basis. Accordingly, the Court of Appeals has shed light on the meaning of “just cause” for the termination of limited liability companies over the years through its rulings. 

In one illuminating case, where (i) the limited liability company had incurred continuous losses, (ii) significant disagreements existed between the shareholders, (iii) the limited liability company was in debt, (iv) the limited liability company could not carry out its business activities, and (v) the shareholders had no interest in the continuation of the company, the 11th Civil Chamber of the Court of Appeals ruled for the termination of the limited liability company (decision dated October 18, 2016, and numbered 11101/8204).

In another significant case, the 11th Civil Chamber of the Court of Appeals ruled (with the decision dated June 13, 2016, and numbered 10730/9482) for the termination of a family-run limited liability company due to the following factors: (i) shareholders were divorced, (ii) defendant shareholder had established another company with a different scope of activity, (iii) the manager had failed to provide due care for the management of the company. 

Furthermore, in several other cases, the following reasons have also been accepted and recognized as “just causes”: (i) mismanagement of the company, (ii) personal interests coming to the forefront (i.e., being prioritized) among the shareholders of the limited liability company, (iii) company being in debt, (iv) the fact that it has become impossible to realize or fulfill the common objectives of the limited liability company. However, the Court of Appeals has also ruled that there are certain circumstances which do not constitute “just cause” for the termination of a limited liability company, such as the existence of due tax debts or the non-distribution of dividends.

II. Exit Right of Shareholders

Article 638 of the TCC sets forth that each shareholder has the right to exit and depart from a limited liability company by filing a lawsuit if there is “just cause” and if there is a provision in the articles of association of the company providing an “exit right” for shareholders. 

The Court of Appeals has illuminated what constitutes a “just cause” that is sufficient to allow a shareholder to exercise its exit right in a limited liability company. In this context, the Court has ruled that (i) disagreements between shareholders, (ii) continuous violation of a shareholder’s right to obtain information on the management and activities of the company, (iii) the alienation of a shareholder from the company, and (iv) a situation in which the company falls into debt due to the actions of the directors, would be deemed as “just causes” (11th Civil Chamber of Court of Appeals’ decision dated June 22, 2016, and numbered 2015-9114/6883).

III. Squeeze-out of Shareholders

Article 640 of the TCC regulates that a company may request the “squeeze-out” of a shareholder from a limited liability company due to (i) the presence of circumstances set forth in the articles of association of the company (pursuant to a general assembly decision), and (ii) “just cause.”

The 11th Civil Chamber of the Court of Appeals has ruled (in a decision dated November 21, 2016, and numbered 2015-11660/8995) that (i) adverse statements against other shareholders, and (ii) breach of the duty of loyalty toward the company and other shareholders, will be deemed as “just causes” for squeezing out the relevant shareholder from the limited liability company. 

IV. Conclusion

The continuity and preservation of companies is a fundamental tenet under Turkish laws. Therefore, the termination of a company should be the last resort for resolving disputes between shareholders and/or between a shareholder and the company. On the other hand, taking into account the necessities and dynamics of business relationships, Turkish laws do value and consider the possibility of the parties’ wishing to leave a business partnership. Therefore, the concept of “just cause” is of great significance in cases where one or more parties would like to terminate a business partnership. Since there is no explicit definition of the term “just cause” provided under Turkish laws, the courts exercise broad discretion to define the term according to doctrine and their own judicial philosophies, and practitioners will be well advised to continue to follow the decisions of the Court of Appeals very closely.

(First published by Mondaq on December 3, 2018)

By Gonenc Gurkaynak, Partner, Nazlı Nil Yukaruc, Partner, and Busra Ustuntas, Associate ELIG Gürkaynak Attorneys-at-Law

Shortly after its establishment with the Turkish Data Protection Law No. 6698 (“Law”), the Turkish Data Protection Authority (“DPA”) has started to observe the data protection ecosystem of Turkey. In this regard, the DPA has been focusing on the areas, where data protection concerns are perceived more concentratedly. One of the instruments that the DPA has been putting to use is adopting resolutions, where the violation is prevalent.  It is worth to note that “resolutions” are different than “decisions” in nature within the meaning of the Law.

As paragraph 6 of Article 15 proposes, “As a result of the inspection conducted either ex officio or upon complaint, in case it is determined that the violation is prevalent, the Board shall adopt a resolution and publish it.” Differently from the DPA’s decisions, resolutions are adopted in cases where the violation not only exists but also prevalent. Also, the Law supposes that the resolutions must be published whereas the decisions are only served to the concerned parties since they are based on at a one-time act. 

Within this Article, we will discuss the DPA’s recent resolution adopted with a view to prevent the companies from reaching out to their customers or potential customers without their explicit consent for advertising purposes by means of SMS, e-mail, and calls.  

Recent Resolution of the DPA

SMS and e-mails have been one of the most preferred ways by companies within the recent years for reaching out to their customers for advertising purposes. Since companies can make announcements about their new products, campaigns, discounts and other marketing relating subjects through a single SMS, a call or an e-mail, these platforms have become more appealing than other traditional advertising instruments. 

It is also undeniable that their convenience and accessibility create significant competitive advantage to firms which are highly engaged with their consumers. Those being said, individuals have a right to not receive those advertisements thanks to the data protection regulations. Since the mentioned instruments are directly linked to consumers’ mobile phones, personal computers and other personal devices, this issue inevitably becomes closely related to personal data and its protection.  

As such, the DPA adopted a resolution dealing with this issue and published it on October 1, 2018 in the Turkish Official Gazette. The DPA has concluded that it received numerous complaints about advertisements sent through e-mail, SMS, and calls without explicit consent of the individuals and determined that these operations constitute a violation. As the violation was found to be prevalent by the DPA, it adopted the following resolution:

• The operations of the data controllers and the data processors acting on behalf of the data controllers, who send SMS or e-mails or make calls for advertising purposes shall be stopped unless they have explicit consent of the data subjects or satisfy the conditions given in the Article 5 for processing.
• Data controller shall take all necessary technical and organizational measures for providing an appropriate level of security in order to prevent unlawful processing of personal data, prevent unlawful access to personal data, and safeguard personal data. In case personal data are processed on behalf of the data controller by another natural or legal person, the data controller shall be jointly liable with such persons with regard to taking the measures.
• Administrative fines will be imposed in the scope of Article 18 to the persons who continue to be a part of above-mentioned actions.
• Since the personal data that are subject to processing may have been obtained illegally, these operations will be reported to public prosecutors in accordance with Article 136 of the Criminal Law No. 5237 and Article 136 of the Criminal Procedure Law No. 5271.

This resolution of the DPA clearly gives the indication that DPA is interactive with the applications and requests of the individuals especially regarding the breaches of data protection rights. The DPA will likely to continue to take similar actions and adopt resolutions on subjects that affect individuals’ everyday lives and privacy.

By Ertugrul Can Canbolat, Senior Associate, Baran Can Yıldırım, Associate, Seniha Irem Akın, Associate, Actecon

I. Scope of the registration obligation under Turkish legislation

Data controllers processing personal data in the Turkish jurisdiction (including processing activities that are conducted abroad, but have an effect in Turkey) are required to enroll to the Data Controllers’ Registry (“Registry”). This requirement is regulated under Article 16/2 of the Data Protection Law (“DP Law”), which expressly states that “real persons or legal entities processing personal data are obliged to enroll to the Data Controllers’ Registry.” Although the letter of the law seems applicable to all data controllers, the Data Protection Board (“Board”) has introduced certain exemptions to this obligation, which will be explained in detail below. 

According to the DP Law, a data controller will need to register prior to commencing its data processing activities. However, the Board has provided certain grace periods for the registration requirement in a recent decision (No. 2018/88), and it has established the applicable deadlines for the registration of data controllers who are already in possession of and processing personal data. Data controllers are obliged to provide certain information, such as (i) identity, (ii) address, and (iii) purpose of the data processing activity, during the registration process. Once a data controller is enrolled to the Registry, any changes to the registered information will need to be notified to the Registry as well.

Data controllers will register to the Registry through an online information system known as “VERBIS.” The information requested from the data controllers will vary depending on which of the following three categories a data controller belongs to: (i) real person or legal entity resident in Turkey, (ii) real person or legal entity resident abroad, and (iii) public institutions. If data controllers fail to comply with the registration obligation, the Board may impose an administrative fine. 

II. Turkey’s registration obligation compared to EU Directive 95/46/EC and the GDPR 

The DP Law is mainly based on the EU Directive 95/46/EC (“Directive”), with certain relatively minor differences. Thus, the registration obligation is quite similar to the requirements of the Directive. Similar to the DP Law, the Directive stipulates that the data controller (or a representative) must notify the supervisory authority before commencing or carrying out a data processing activity. The Directive further indicates that the notification must specify certain information, such as the name and address of the data controller and of its representative, if any; the purpose or purposes of the processing; and a description of the category or categories of the data subject, as well as a description of the data or categories of data relating to them, among others. The Directive requires the EU member states to take the necessary measures to ensure that data processing activities are publicized. 

On the other hand, the EU General Data Protection Regulation (“GDPR”) differs significantly from the European Council’s approach in the Directive. When the GDPR came into force on May 25, 2018, the regulation regarding the requirement to provide notification to the supervisory authority has changed. Data controllers are no longer obliged to register their personal data processing activities to a registry system. Rather, the GDPR adopts a self-regulating approach, and depends on the accountability of the data controllers. Accordingly, the GDPR requires that data controllers shall maintain the relevant records internally under their own care and responsibility, and make them available to the supervisory authorities upon request.

III. Exemptions 

Pursuant to Article 16/2 of the DP Law, the Board is entitled to provide and specify certain exemptions to the registration obligation. According to the Board’s decision No. 2018/32, the following data controllers are exempt from the obligation to register: (i) real persons and legal entities that process personal data by non-automatic means, on the condition that such data are part of a data-filing system, (ii) notaries operating under the Notary Law No. 1512, (iii) associations founded under the Law No. 5253 on Associations, foundations established per the Law No. 5737 on Foundations, and trade unions established under the Law No. 6356 on Trade Unions and Collective Bargaining Agreements, who only process the personal data of their own employees, enrollees, members and donors, in accordance with the applicable legislation and its purposes and within the scope of their field of activity, (iv) political parties founded in accordance with the Law No. 2820 on Political Parties, (v) attorneys who are working under the Attorneyship Law No. 1136, and (vi) certified public accountants and sworn-in public accountants operating under the Law No. 3568 on Public Accountancy and Auditing. 

The Board published another noteworthy decision recently (No. 2018/87), which is applicable to all data controllers, wherein it announced that data controllers who have fewer than fifty (50) yearly employees and whose annual financial balance sum does not exceed the amount of twenty-five million Turkish Liras (TL 25,000,000) will be exempt from the registration obligation, as long as their main business activity does not concern processing special categories of personal data (such as personal data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other belief, clothing, membership in associations, foundations or trade-unions, health, sexual life, convictions and security measures, as well as biometric and genetic data).

IV. Registration procedure 

The procedures and principles with regards to the registration obligation have been regulated and stipulated under the Regulation on the Data Controllers’ Registry (“Regulation”). According to the Regulation, all transactions regarding the registry should be conducted by the data controllers through an information system called “VERBIS.” VERBIS went live and became operational on October 1, 2018. The Personal Data Protection Authority (“DPA”) published a privacy information notice, and according to this notice, the information provided by data controllers during their registration to VERBIS (e.g., names, tax numbers, representative’s personal data, etc.) will only be used by the DPA in relation to the registration obligation. Furthermore, data subjects may apply to the DPA, which will be acting as the data controller in terms of such information, regarding the use of their data. In order to access VERBIS, data controllers will be required to first sign up to the system by filling out a form. The information that will be requested from the data controllers during the registration process are as follows: 

1. For data controllers residing in Turkey: (i) Identity number (for real persons) or tax identity number and registered tax office information (for real person or legal entity data controllers), (ii) Corporate electronic mail addresses, as the Regulation states that that all notifications and communications regarding VERBIS will be conducted by using this e-mail address, (iii) Landline phone numbers or mobile phone numbers, (iv) Address number of the data controller (the 10-digit address number may be obtained through the online system at https://adres.nvi.gov.tr/VatandasIslemleri/AdresSorgu), and (v) “Registered electronic mail (KEP) address” for data controllers who have a registered electronic mail address (however, this is not mandatory for data controllers who do not possess a registered electronic mail address).

2. For data controllers residing outside of Turkey: (i) Title, electronic mail address, telephone number, address information, country of residence, date of the decision appointing the data controller’s representative (“Representative”) and, if available, the number of this decision. If the appointed Representative is a Turkish citizen, his/her identity number (“TCKN”); if the Representative is a legal entity established in Turkey, its tax identity number along with its registered tax office, (ii) Corporate electronic mail address, (iii) Representative’s address, and (iv) Representative’s registered electronic mail (KEP) address for data controllers who have a registered mail address (however, this is not obligatory if the Representative does not have a registered electronic mail address). 

Data controllers may access the VERBIS system and assign a Representative for themselves once the sign-up process is completed. Thus, the Representative may also access VERBIS by using Turkey’s digital platform for its citizens (known as “e-devlet” and available at https://www.turkiye.gov.tr/), and the Representative will be asked to provide information regarding the data controller’s personal data processing activities and may hereafter complete the data controller’s registration process.

V. Registration Timetable

The Board has recently issued a decision (No. 2018/88), which sets forth certain grace periods for data controllers to enroll to the Registry. Data controllers are required to comply with their registration obligations according to the following schedule, depending on their categorization:

1. Between October 1, 2018, and September 30, 2019, for data controllers whose number of yearly employees exceeds fifty (50) or whose annual financial balance sum exceeds twenty-five million Turkish Liras (TL 25,000,000), 
2. Between October 1, 2018, and September 30, 2019, for data controllers who are resident or established abroad, 
3. Between January 1, 2019, and March 31, 2020, for data controllers whose number of yearly employees is less than fifty (50) and whose annual financial balance sum does not exceed twenty-five million Turkish Liras (TL 25,000,000), but whose main business activity concerns the processing of special categories of personal data (as listed above),
4. Between April 1, 2019, and June 30, 2020, for data controllers who are public entities or public institutions.

Since the Registry has only recently become operational, and since we are still within the grace period(s) as of the date of this article, we may expect certain practical issues and problems to arise during the registration process that might require addressing. At this stage, data controllers should make use of the aforementioned grace periods to finalize their internal preparations (such as the identification and classification of their data processing activities) before enrolling to the Registry, in order to ensure compliance with the registration obligation in due time.

(First published by Mondaq on November 7, 2018)

By Gonenc Gurkaynak, Partner, Ilay Yılmaz, Partner, and Burak Yesilaltay, Associate, ELIG Gürkaynak Attorneys-at-Law